Comprehensive Risk Analysis of Open Source Software_Defense Unicorns

Open Source Software (OSS) plays a central role in the Department of the Air Force’s (DAF) software ecosystem, enabling faster development, increased flexibility, and cost savings across mission-critical systems. However, the transparency and community-driven nature of OSS also create serious risks. Adversaries increasingly target OSS supply chains to insert malicious code or vulnerabilities into widely used components. These risks are difficult to detect and manage—especially in secure or disconnected environments where trust and verification are essential.Recent updates to federal and DoD security policies, including NIST SP 800-53 Rev. 5 (control CM-10(1)), Executive Order 14028, and the DoD Zero Trust Architecture (ZTA), require organizations to thoroughly analyze and document the risks associated with OSS. Yet, no standardized, repeatable method currently exists across the DoD for evaluating OSS within enclave architectures. Risk assessments are often manual, inconsistent, and dependent on individual expertise. This results in delays, uneven security outcomes, and barriers to adopting secure software at speed.This SBIR Phase I project will address that gap by developing a set of Tactics, Techniques, and Procedures (TTPs) to evaluate OSS in secure development enclaves. The goal is to create a practical, repeatable framework that enables cybersecurity personnel to determine if OSS use supports a credible basis for secure operation. These TTPs will support both early system design and ongoing updates and will align with DoD mandates for Zero Trust and secure software supply chain management.The TTPs will be integrated into the Defense Unicorns UDS platform, which already accelerates secure software delivery using tools like Zarf (packaging and SBOMs) and Pepr (runtime config automation). This integration will provide a complete path from OSS evaluation to deployment, reducing Authority to Operate (ATO) timelines and improving trust in OSS components.Validated through Air Force Software Enterprise (SWENT) use cases, this solution will be built for broader DoD adoption. It will also support future R&D opportunities in automation, real-time OSS monitoring, machine learning-based risk scoring, and integration into cATO pipelines.This work will provide the DoD with a trusted, Zero Trust-aligned OSS risk analysis framework that can evolve with new threats and mission needs—supporting secure software adoption across air, space, cyber, and multi-domain operations.